Patch-to-exploitation timelines for edge appliances (Fortinet, SonicWall, Ivanti), with detection rules.
Vendor: Fortinet
Product: FortiSandbox
Vendor advisory: FG-IR-26-141
EPSS: 0.761 (99.5th percentile, 2026-10-30)
Advisory → KEV: 37 days
FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS are affected by a vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2026-07-16.
Reviewed by PerimeterClock.
| Date | Event | Source |
|---|---|---|
| 2026-06-09 | Vendor advisory published | Fortinet PSIRT |
| 2026-07-16 | Added to CISA KEV (confirmed exploitation) | CISA KEV |
Affected and fixed versions: see the vendor advisory or NVD entry below.